GHSA-272M-GCWP-MPWG vulnerabilities

Vulnerabilities for packages: thingsboard, tez, cassandra, management-api-for-apache-cassandra-5.0...

CVE-2026-56820 vulnerabilities

Vulnerabilities for packages: thingsboard, tez, cassandra, management-api-for-apache-cassandra-5.0...

GHSA-WC96-39FC-566F vulnerabilities

Vulnerabilities for packages: thingsboard, tez, cassandra, management-api-for-apache-cassandra-5.0...

GHSA-G7HG-VRCF-MVMR vulnerabilities

Vulnerabilities for packages: thingsboard, tez, cassandra, management-api-for-apache-cassandra-5.0...

CVE-2026-56822 vulnerabilities

Vulnerabilities for packages: thingsboard, tez, cassandra, management-api-for-apache-cassandra-5.0...

CVE-2026-63317 Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in @rootio/tar - Patched by Root

Root has patched CVE-2026-59875 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

MAL-2026-11041 Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

GHSA-35RM-7J9C-2F7M vulnerabilities

Vulnerabilities for packages: zed...

CVE-2026-53600 vulnerabilities

Vulnerabilities for packages: zed...

GHSA-89XV-2M56-2M9X vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, homepage, langfuse, keep-fips, keep, peerdb-ui, langfuse-fips...

CVE-2026-53600 vulnerabilities

Vulnerabilities for packages: zed...

GHSA-35RM-7J9C-2F7M vulnerabilities

Vulnerabilities for packages: zed...

Photon OS 5.0: Linux PHSA-2026-5.0-0928

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0928. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

OPENSUSE-SU-2026:11366-1 mcphost-0.34.0-9.1 on GA media

These are all security issues fixed in the mcphost-0.34.0-9.1 package on the GA media of openSUSE Tumbleweed...

python313-3.13.14-1.1 on GA media (moderate)

python313-3.13.14-1.1 on GA media Announcement ID: openSUSE-SU-2026:11342-1 Rating: moderate Cross-References: CVE-2021-4189 CVE-2025-15366 CVE-2025-15367 CVE-2026-11940 CVE-2026-7210 CVE-2026-8328 CVSS scores: CVE-2021-4189 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2025-15366...

Photon OS 5.0: Nasm PHSA-2026-5.0-0925

An update of the nasm package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0925. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

OPENSUSE-SU-2026:21432-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version boo1266618...